1

TBI: EndTBI: End--toto--End Network End Network Performance Performance TestbedTestbed for for

Empirical Bottleneck DetectionEmpirical Bottleneck DetectionPrasad Prasad CalyamCalyam,,

OARnetOARnet, A Division of The Ohio Supercomputer Center,, A Division of The Ohio Supercomputer Center,The Ohio State University The Ohio State University

TRIDENTCOM, TRIDENTCOM, TrentoTrento, Italy, February 2005, Italy, February 2005DimaDima KrymskiyKrymskiy, , MukundanMukundan SridharanSridharan, Paul , Paul SchopisSchopis

2

Topics of Discussion

Third Frontier Network Measurement Project Basics of Network Measurement

Infrastructures (NMIs)“ActiveMon” NMI SoftwareTFN Beacon Infrastructure (TBI) TestbedEnd-to-End Network Performance Bottleneck

Detection Case Studies!Work in progress…Conclusion

3

Third Frontier Network

The Third Frontier Network (TFN) funded by the Ohio Board of Regents

A dedicated high-speed fiber-optic network linking Ohio colleges and universities with research facilities to promote research and economic developmentOver 1,600 miles of fiber has been purchased to create a network backbone in Ohio to connect colleges and universities, K-12 schools, and communities together

4

Third Frontier Network (2)

5

TFN Measurement Project

Started in early 2004Project funding from the Ohio Board of RegentsTo ensure that University campuses can effectively use the advanced networking services the new network provides

Project PartnersOARnet (Project Lead and Co-ordination)University of Cincinnati, Cincinnati State, The Ohio State University, Kent State University, Southern State Community College, University of Toledo, Wright State University

6

Project Goals

Identify end-to-end performance bottlenecks in the TFN on an ongoing fashion by building a comprehensive Network Measurement Infrastructure (NMI)Test new and advanced technologies and equipment before wide-scale adoption in the TFN Higher Education communities

Technologies: H.323/SIP based Voice and Videoconferencing, MPEG3, HDTV, Multicast, Bulk FTPEquipment: Video streaming Caches, Firewalls, Intrusion Detection Systems, Traffic shapers

Bring awareness and train campus-networking professionals to make optimum use of the capabilities of TFN so that their campus network infrastructures can be upgraded suitably

7

Project Goals

Identify end-to-end performance bottlenecks in the TFN on an ongoing fashion by building a comprehensive Network Measurement Infrastructure (NMI)Test new and advanced technologies and equipment before wide-scale adoption in the TFN Higher Education communities

Technologies: H.323/SIP based Voice and Videoconferencing, MPEG3, HDTV, Multicast, Bulk FTPEquipment: Video streaming Caches, Firewalls, Intrusion Detection Systems, Traffic shapers

Bring awareness and train campus-networking professionals to make optimum use of the capabilities of TFN so that their campus network infrastructures can be upgraded suitably

8

What constitutes the “infrastructure”in an NMI?

Measurement Toolkit hosted on “Beacon”serversScheduler for measurement orchestration between multiple measurement serversLarge database for storage and archiving measurement dataAnalysis Engine and web service for visualization of network performance dataAAA procedures for handling Security/Privacy Issues

9

A Typical NMI

10

Examples of NMI Software and Deployments…

NIMI (Developed by Vern Paxson, currently maintained by NLANR)Surveyor (Developed by Advanced, currently maintained by Univ. Of Wisconsin)AMP (NLANR)IEPM-BW (SLAC)Scriptroute (Univ. of Washington)E2E piPES (Internet2)Many Many More… (ETOMIC, D-ITG, …)ActiveMon (Being developed by OARnet)

11

“ActiveMon” NMI SoftwareAn “application-specific” active measurement toolkit

To identify bottlenecks pertaining to specific applications; e.g., Voice and Video over IP (Delay, Jitter, Loss, Reordering), Bulk FTP flows (Throughput, Available/Bottleneck Bandwidth, Web server/ Oracle server response times, etc…

An advanced active measurements scheduler-”OnTimeMeasure”

To orchestrate and regulate network-wide active measurements

An analysis engine with web interfaceTo correlate performance along multiple paths To generates appropriate alerts for concerned personnel!

Support for federated measurements…To support end-to-end performance debugging along multiple ISP domains

12

ActiveMon Measurement Toolkit

Tools used for end-to-end network performance data collection

Ping (Delay) Open SourceTraceroute (Topology) Open SourceIperf (TCP/UDP Bandwidth Performance) Open SourcePathchar (Hop-by-Hop performance) Open SourcePathload (Available Bandwidth) Open SourcePathrate (Bottleneck Bandwidth) Open SourceOWAMP (µs Precision Delay – CDMA+NTP) Open SourceH.323 Beacon (Voice/Video Performance) Open SourceappareNet (Hop-by-Hop Performance) CommercialNetQoS (Application Response Times) Commercial

13

“OnTimeMeasure” Scheduler

Active measurements can encroach network bandwidth required for actual application traffic

Active measurements need to be regulatedRunning multiple simultaneous measurements on monitoring probes could result in misleading reports of network performance

Active measurements require dedicated system and network resources

Network Interface Card (NIC), CPU processing, Application ports, Multimedia codecs, Bandwidth, …

Active measurements between measurement beacons need to be orchestrated

14

Results in a LAN with WAN Emulation!

15

OnTimeMeasure Framework

16

OnTimeMeasure Framework

17

ActiveMon Analysis Engine

To retrieve relevant “summary-views” of the large network-wide active measurement datasets

“Weather-map” functionality, Query-able XML schemas, …To effectively identify anomalies and alert relevant support and operations personnel

Target for a low probability of false-alarmsCover anomalies that indicate better/poor/marginal changes

To perform multi-path data correlation to isolate performance problems involving multiple-links

Observed end-to-end performance is a function of performance of individual intermediate links

18

Example: Alarm check to notify network health status

Watermarks for “Good”, “Acceptable” and “Poor” grade of audiovisual quality as experienced by end-user

Delay: (0-150)ms, (150-300)ms, > 300msJitter: (0-20)ms, (20-50)ms, > 50msLoss: (0-0.5)%, (0.5-1.5)%, >1.5%

Prasad Calyam, Mukundan Sridharan, Weiping Mandrawa, Paul Schopis, “Performance Measurement and Analysis of H.323 Traffic”, Proceedings of Passive and Active Measurement Workshop (PAM), 2004

19

TFN Beacon Infrastructure (TBI) Testbed

20

TFN Beacon Infrastructure (TBI) Testbed

21

Paths being Measured

22

Purpose of TBI Testbed

To understand network end-to-end performance characteristics

Via partial path and intermediate bottleneck hop analysisTo understand network performance measurement data reported by various tools

How good are they to empirically correlate network events in a routine monitoring infrastructure?

To compare performance at campus, regional, national-academic and national-commericalbackbone network levels

To quantify end-to-end network performance stability in the Internet

23

End-to-End Network Performance Bottleneck Detection Case Studies!

Anomalies in measured paths…(2-month period)

Effects of route changesNetwork device misconfigurationMisrepresentation of network health by measurement tool misconfiguration

Performance comparison of campus, regional, national-academic and national-commercial backbone networks using H.323 Beacon

24

Effects of route changes

Jitter OSUB to OSUL(both directions)

RTT OSUB to OSUL

RTT OSUL to OSUB

25

Effects of route changes (2)

RTT UOCB to OSUB

RTT OSUB to UOCB

26

Network device misconfiguration

Available Bandwidth OSUB to UOCB

27

“Ocean Wave” Anomaly of OWAMP

RTT UOCB to OSUB

28

H.323 Beacon*

An application-specific measurement toolTo monitor and qualify the performance of H.323

Videoconferencing sessions at the host and in the network (end-to-end)

Useful to an end-user/conference operator/network engineerAddresses problems due to H.323 protocol-specific idiosyncrasies

Can be generalized to RTP packets performance over the networkMany in-built tools that generate various kinds of measurement data for pre/during/post Videoconference troubleshooting!

An “easy to install and use” tool that is open source

* Project supported by Internet2, The Ohio Board of Regents, OARnet

29

A few H.323 Beacon screenshots…

http://www.itecohio.org/beacon

30

Performance comparison of academic and commercial network backbones using H.323 Beacon

Most Stable Least StableAcademic networks most suitable for Voice and Video over IP applicationsBottlenecks of multi-domain/last-mile links mainly impact end-to-end performance

31

ActiveMon work in progress…

Extend testbed into a production-level NMI spanning TFN and major Ohio-based University CampusesBetter multi-link data correlations in Analysis EngineDDoS anomaly detection using active measurement data signaturesOnTimeMeasure extensions using real-time scheduling principles for various active measurementspecificationsBetter visualization module…Planning on ActiveMon 1.0 release on sourceforge(Summer 2005)

http://sourceforge.net/projects/activemon/

32

Thanks!

Scripts Development and Data AnalysisMukundan Sridharan, Dima Krymskiy, Phani Kumar Arava

Project ManagementSteve Gordon, Paul Schopis

OSU Border and Lab DeploymentProf. David Lee, Dave Kneisly, Arif Khan, Weiping Mandrawa

UC Border and Lab DeploymentProf. Jerry Paul, Prof. Fred Annexstein, Bruce Burton, Bill Bohmer, Tom Ridgeway, Michal Kouril, Diana Noelcke

NCSU DeploymentJohn Moore, Chintan Desai

Tools DeploymentLoki Jorgenson, Chris Norris (appareNet)Jeff Boote (OWAMP)Leandro Lustoza (H.323 Beacon E-Model implementation)

33

Questions?

http://tfn.oar.net/measurement TFN Measurement Project Reference: